Internet of Things (IoT) paved the way for devices and machine communication using TCP/IP protocol. Lightweight and stateless communication is imperative especially in a situation requiring conservation of energy usage, e.g. wireless sensor network. Representational State Transfer (REST) API method is based on web communication protocol, Hyper-Text Transfer Protocol (HTTP), and is widely used in IoT messaging. Some of these protocols are DPWS, XMPP, MQTT, COaP, AMQP. Among these protocols, MQTT is the most preferred protocol and is expected to be the de facto messaging IoT standard. MQTT uses a publisher/subscriber model to facilitate messaging between devices making messaging lightweight. Nevertheless, there are a number of security issues due to the design of the protocol itself. Some of the issues are denial of service, identity spoofing, information disclosure, elevation of privileges and data tampering. These issues can be caused by both internal and external perpetrators. Researchers have proposed various security techniques and mechanisms to address these issues. Incorporation of security has added processing overhead to the devices and this will have a bearing on IoT devices that are powered by a battery. This issue has opened up new research challenges in making the protocols more lightweight and at the same time not compromising the level of security provided.

The increasing incidence of distributed denial-of-service (DDoS) attacks has made software-defined networking (SDN) more vulnerable to the depletion of controller resources. DDoS attacks prevent the SDN controller from processing all incoming data efficiently, potentially disrupting a network or denying legitimate users access to network services. Thus, the protection of the SDN controller is crucial, especially from the ones that exploit the SDN characteristics. In this paper, the authors propose an efficient detection approach for low- and high-rate DDoS attacks on the controller with a high detection rate and a low false positive rate by adapting a dynamic threshold algorithm rather than a static one and proposing a new rule-based detection mechanism. In addition, the proposed approach was evaluated using eight simulation scenarios representing all potential attacks against the SDN controller in terms of attack traffic rates (low or high), sources (either single or multiple hosts), and targets (single or multiple victims). The experiment results show that the proposed approach is more effective than the existing approaches based on attack detection and false positive rates.

Software-defined networking (SDN) is a unique network architecture isolating the network control plane from the data plane, offering programmable elastic features that allow network operators to monitor their networks and efficiently manage them. However, the new technology is security deficient. A DDoS attack is one of the common attacks that threaten SDN controllers, leading to the degradation or even collapse of the entire SDN network. Entropy-based approaches and their variants are considered the most efficient approaches to detecting DDoS attacks on SDN controllers. Therefore, this work analyzes the feasibility and impacts of an entropy-based DDoS attack detection approach for detecting low-rate and high-rate DDoS attacks against the controller, measured in terms of detection rate (DR) and false-positive rate (FPR), triggered by a single or multiple host attacks targeting a single or multiple victims. Eight simulation scenarios, representing low and high DDoS attack traffic rates on the controller, have been used to evaluate an entropy-based DDoS attack detection approach. The experimental results reveal that the entropy-based approach enhances the average DR for detecting high-rate DDoS attack traffic compared with low-rate DDoS attack traffic by 6.25%, 20.26%, 6.74%, and 8.81%. In addition, it reduces the average FPRs for detecting a high DDoS attack traffic rate compared with a low DDoS attack traffic rate by 67.68%, 77.54%, 66.94%, and 64.81.

Message Queuing Telemetry Transport (MQTT) is expected to be the de facto messaging IoT standard. Therefore, MQTT must achieve efficient security. Nevertheless, the most significant drawback of the MQTT is its lack of protection mechanisms. Meanwhile, the existing approaches have added processing overhead to the devices and are still vulnerable to various attacks. Therefore, this research work presented an integrated scheme known as the Robust Security Scheme (RSS) to protect the MQTT against any exploitations that might result in sophisticated cyberattacks. The proposed RSS employs two cryptosystems: (1) a dynamic variant of the Advanced Encryption Standard (D-AES) and (2) Key-Policy Attribute-Based Encryption (KP-ABE). RSS introduces a new design architecture of the symmetric AES algorithm to encrypt the MQTT payload called D-AES. Additionally, the second part of the proposed hybrid cryptosystem is KP-ABE, which is utilized to cipher the private key of the proposed D-AES to avoid the computation overhead of bilinear maps. The performance of the proposed RSS is measured in terms of processing time and traffic overhead. Additionally, the security aspects are evaluated in terms of balance, avalanche effect, and hamming distance and compared to the existing works in a testbed environment. Results revealed that the proposed D-AES is more promising with improvements than the standard AES algorithm. The proposed scheme achieves polymorphism while maintaining interoperability. RSS exhibited improvements over the standard AES algorithm by 8.75%, 10.45%, and 6.81% in terms of balance, avalanche effect, and hamming distance, respectively.